I’m excited to share something I’ve built: CTF Training, a hands-on, 10-part Capture the Flag curriculum, now public on GitHub.
It’s designed to take someone from “what’s a flag?” to competing as a team under a clock — and it maps directly onto what you’ll see in National Cyber League, US Cyber Games, and collegiate CTFs.
What’s Inside
Ten modules, one per day, each a self-contained README that’s both lesson and lab:
- Day 1–2: CTF fundamentals, Linux & the command line
- Day 3–4: Cryptography essentials and web exploitation (SQLi, XSS, JWTs)
- Day 5–6: Packet analysis and digital forensics (Autopsy, Sleuth Kit, deleted-file recovery)
- Day 7: Reverse engineering (Ghidra, objdump, XOR obfuscation)
- Day 8–10: Team practice, strategy, and a full live CTF
Every module pairs a plain-language explanation with verified, hands-on challenges, so you learn a technique and immediately put it to use. The difficulty ramps within each day, so mixed-skill teams stay engaged together.
Why Public
The public READMEs are answer-free — solving them is the point. I also maintain a separate, private instructor repository with harder and more unique challenges, along with full instructor walkthroughs and answer keys, available to professors, instructors, or coaches.
My hope is that this is useful to professors, instructors, and coaches building CTF skills for competition or for real-world DFIR and incident response work.
Check out CTF Training on GitHub
If you’re a professor, instructor, or coach and would like access to the private repo, reach out to me directly.
Found it useful? A ⭐ on the repo helps others find it. Have a challenge idea or want to contribute? Open an issue or reach out — I’d love to grow this with the community.